rqtefja.site
Open in
urlscan Pro
206.217.131.233
Malicious Activity!
Public Scan
Submission Tags: @ipnigh
Submission: On January 16 via api from GB
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 9th 2020. Valid for: 3 months.
This is the only time rqtefja.site was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Xfinity (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 206.217.131.233 206.217.131.233 | 36352 (AS-COLOCR...) (AS-COLOCROSSING - ColoCrossing) | |
1 | 2607:ae80:2::230 2607:ae80:2::230 | 26558 (FREEWHEEL) (FREEWHEEL - Freewheel Media Inc.) | |
1 2 | 52.49.106.118 52.49.106.118 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 178.250.2.157 178.250.2.157 | 44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE) | |
3 | 2a02:26f0:6c0... 2a02:26f0:6c00:18a::1b62 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 204.13.194.235 204.13.194.235 | 29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus) | |
9 | 2.18.235.40 2.18.235.40 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 151.101.113.108 151.101.113.108 | 54113 (FASTLY) (FASTLY - Fastly) | |
2 | 2a02:26f0:6c0... 2a02:26f0:6c00:18c::2c06 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
31 | 10 |
ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: 206-217-131-233-host.colocrossing.com
rqtefja.site |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-49-106-118.eu-west-1.compute.amazonaws.com
xfinitydigital.demdex.net |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com
z.moatads.com | |
px.moatads.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
rqtefja.site
rqtefja.site |
214 KB |
9 |
moatads.com
z.moatads.com px.moatads.com |
94 KB |
6 |
xfinity.com
sdx.xfinity.com oascentral.xfinity.com dl.cws.xfinity.com |
82 KB |
2 |
demdex.net
1 redirects
xfinitydigital.demdex.net |
2 KB |
1 |
adnxs.com
cdn.oas-c18.adnxs.com |
688 B |
1 |
criteo.com
rtax.criteo.com |
55 B |
1 |
fwmrm.net
7468.v.fwmrm.net |
399 B |
0 |
tidaltv.com
Failed
dmp.tidaltv.com Failed |
|
31 | 8 |
Domain | Requested by | |
---|---|---|
11 | rqtefja.site |
rqtefja.site
|
8 | px.moatads.com |
rqtefja.site
|
3 | sdx.xfinity.com |
rqtefja.site
|
2 | dl.cws.xfinity.com |
rqtefja.site
|
2 | xfinitydigital.demdex.net |
1 redirects
rqtefja.site
|
1 | cdn.oas-c18.adnxs.com |
rqtefja.site
|
1 | z.moatads.com |
oascentral.xfinity.com
|
1 | oascentral.xfinity.com |
rqtefja.site
|
1 | rtax.criteo.com |
rqtefja.site
|
1 | 7468.v.fwmrm.net |
rqtefja.site
|
0 | dmp.tidaltv.com Failed |
rqtefja.site
|
31 | 11 |
This site contains links to these domains. Also see Links.
Domain |
---|
oascentral.xfinity.com |
www.comcast.net |
www.surveymonkey.com |
idm.xfinity.com |
customer.xfinity.com |
my.xfinity.com |
xfinity.comcast.net |
customer.comcast.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
rqtefja.site cPanel, Inc. Certification Authority |
2020-01-09 - 2020-04-08 |
3 months | crt.sh |
*.v.fwmrm.net DigiCert SHA2 High Assurance Server CA |
2017-11-01 - 2021-01-13 |
3 years | crt.sh |
*.demdex.net DigiCert SHA2 High Assurance Server CA |
2018-01-09 - 2021-02-12 |
3 years | crt.sh |
*.criteo.com DigiCert ECC Secure Server CA |
2019-12-05 - 2021-04-08 |
a year | crt.sh |
www.xfinity.comcast.net COMODO RSA Organization Validation Secure Server CA |
2019-09-10 - 2021-09-09 |
2 years | crt.sh |
oascentral.comcast.net COMODO RSA Organization Validation Secure Server CA |
2019-04-26 - 2021-04-25 |
2 years | crt.sh |
moatads.com DigiCert ECC Secure Server CA |
2018-11-10 - 2020-02-09 |
a year | crt.sh |
cdn.adnxs.com GlobalSign CloudSSL CA - SHA256 - G3 |
2019-05-16 - 2020-05-16 |
a year | crt.sh |
*.cws.xfinity.com Sectigo RSA Organization Validation Secure Server CA |
2019-01-28 - 2021-01-27 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://rqtefja.site/gd65e7cj/e35484aed11ed2b250c3637706cfd52f/login.php
Frame ID: 4351F3F214481A134E519984127148D6
Requests: 33 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
AppNexus (Advertising Networks) Expand
Detected patterns
- html /<(?:iframe|img)[^>]+adnxs\.(?:net|com)/i
Lodash (JavaScript Libraries) Expand
Detected patterns
- script /lodash.*\.js/i
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Ad Info
Search URL Search Domain Scan URL
Title: Ad Feedback
Search URL Search Domain Scan URL
Title: username
Search URL Search Domain Scan URL
Title: password
Search URL Search Domain Scan URL
Title: Create one
Search URL Search Domain Scan URL
Title: Pay any balance
Search URL Search Domain Scan URL
Title: Terms of Service
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Site Map
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://xfinitydigital.demdex.net/event?d_sid=4702129 HTTP 302
- https://xfinitydigital.demdex.net/firstevent?d_sid=4702129
31 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
rqtefja.site/gd65e7cj/e35484aed11ed2b250c3637706cfd52f/ |
13 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lodash-slim.min.js
rqtefja.site/gd65e7cj/e35484aed11ed2b250c3637706cfd52f/static/js/data-layer/ |
23 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tracking-aws.min.js
rqtefja.site/gd65e7cj/e35484aed11ed2b250c3637706cfd52f/static/js/data-layer/ |
2 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tracking-DTM.min.js
rqtefja.site/gd65e7cj/e35484aed11ed2b250c3637706cfd52f/static/js/data-layer/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tracking.min.js
rqtefja.site/gd65e7cj/e35484aed11ed2b250c3637706cfd52f/static/js/data-layer/ |
15 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
satelliteLib-531bc4f46256650a84099973f0ed331f809ea5f4.js
rqtefja.site/gd65e7cj/assets.adobedtm.com/43896e740dcedef854392e0be6ea80deb8eb2ba5/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles-light.minc816.css
rqtefja.site/gd65e7cj/e35484aed11ed2b250c3637706cfd52f/static/css/junket/ |
47 KB 47 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vm-login-form-ad.js
rqtefja.site/gd65e7cj/e35484aed11ed2b250c3637706cfd52f/static/js/ |
9 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
u
7468.v.fwmrm.net/ad/ |
0 399 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
firstevent
xfinitydigital.demdex.net/ Redirect Chain
|
42 B 937 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.12.4.min.js
rqtefja.site/gd65e7cj/e35484aed11ed2b250c3637706cfd52f/static/js/libs/ |
95 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
scripts-responsive.minc816.js
rqtefja.site/gd65e7cj/e35484aed11ed2b250c3637706cfd52f/static/js/ |
7 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
satelliteLib-531bc4f46256650a84099973f0ed331f809ea5f4.js
rqtefja.site/gd65e7cj/assets.adobedtm.com/43896e740dcedef854392e0be6ea80deb8eb2ba5/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rta.js
rtax.criteo.com/delivery/rta/ |
0 55 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
data.json
dmp.tidaltv.com/audience/browser/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-Regular.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
26 KB 26 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1209630564@x32
oascentral.xfinity.com/RealMedia/ads/adstream_jx.ads/comcast.net/login_secure/notve/ |
1 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
moatad.js
z.moatads.com/comcastapn56341864860/ |
269 KB 91 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
empty.gif
cdn.oas-c18.adnxs.com/RealMedia/ads/Creatives/default/ |
43 B 688 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-Medium.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
27 KB 27 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel.gif
px.moatads.com/ |
43 B 409 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
933 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-Light.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
27 KB 27 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
/
dl.cws.xfinity.com/event/ |
0 283 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel.gif
px.moatads.com/ |
43 B 409 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
PUT H2 |
/
dl.cws.xfinity.com/event/ |
110 B 489 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel.gif
px.moatads.com/ |
43 B 409 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel.gif
px.moatads.com/ |
43 B 409 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel.gif
px.moatads.com/ |
43 B 409 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel.gif
px.moatads.com/ |
43 B 409 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel.gif
px.moatads.com/ |
43 B 409 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel.gif
px.moatads.com/ |
43 B 409 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- dmp.tidaltv.com
- URL
- http://dmp.tidaltv.com/audience/browser/data.json?a=6e283e6c8c36498ca8b4ec68f21f8870&callback=adInfo.setComcastOASAudienceData
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Xfinity (Consumer)34 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| _ object| digitalData object| runtimeData object| adInfo boolean| isMobile string| OAS_rns string| OAS_query undefined| GLOBAL_VAR undefined| ct undefined| et undefined| hourElapsed undefined| msg undefined| pixelDomain undefined| isDomless undefined| documentReferrer undefined| isBeta undefined| viewHash undefined| pxSrc undefined| px object| Moat#G26 object| MoatSuperV26 object| Moat#PML#26#1.2 boolean| Moat#EVA undefined| ad undefined| x32adtag string| adtag_x32 function| $ function| jQuery object| login object| shared function| CircleLoader object| jQuery11240078779149663278590 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
7468.v.fwmrm.net
cdn.oas-c18.adnxs.com
dl.cws.xfinity.com
dmp.tidaltv.com
oascentral.xfinity.com
px.moatads.com
rqtefja.site
rtax.criteo.com
sdx.xfinity.com
xfinitydigital.demdex.net
z.moatads.com
dmp.tidaltv.com
151.101.113.108
178.250.2.157
2.18.235.40
204.13.194.235
206.217.131.233
2607:ae80:2::230
2a02:26f0:6c00:18a::1b62
2a02:26f0:6c00:18c::2c06
52.49.106.118
0df906e16d1ed57a686d542ac0e7a620eafb715c12ee0a0c648653b569e72a9b
11da464f86f5ff9850e1ef53dd13336cfbfd38a8f3808d7826d0c1a2d925563f
138c0ead0fbcd09dd455df9870920e8725b367fbf02ac0cef0c62874000ab176
1bdca04f41b797a00f1ac403070d6ea18a459754c41d383ffddf5b0991f04d9d
2a031939885bb7efba89d423c9ee7c0fe2bab465f18db63f40a9ae2bd7bc0228
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
3e43f0b8c64ba48e44e41ed086c7e9779e685e3de148ca4e8eba6e73db6aa222
4059e3d6f8e253fb472c34896e61e444991eed1df770c41039127f94b35f5edb
49d0c079f8431833fb59275e68a7db8b9215dc52068ff63c179e32dfe618a8c4
4bd9c8ed57b1dd8fddcc2910170e9b81b40f7b628e272924e88a98f45ebb9aea
4df4f6996e231f251a41e8200d3fdf2401b513bb4072670fc2bad2d7f182a296
58fd862aaa51daaa186ee3fecfd805c0f8eea09146e9c7deb44a3f30a1ad01b5
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
7a1f723f3e30c5e5ae413e28815bb419e374d0b50e03b25eeb53a25c1ac1c98f
9a752f331543637e77de040e2f91c3e2307cf5826feeb6fb69582c32373dbd3b
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d1e2dfc4882d3951f8b5ce26f342fdbd83dcfc7c5d53cc455dc3703b706fc7c2
deab7ea99ff9c89b629dac639ce06fce96b5dc7065538677e82adc503b9222dc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a